I am pretty sure my website has been hacked. Luckly I have installed a security plugin that (among other things) scans my files for any changed files. I has located 3 files which were added at a time that I was not modifying code in my website.<\/p>\n
Upon investigation these file seem highly suspicious. The code in them seems like hacker code (confusing and not normal code), and also, the files added are named extremely similar to the standard WordPress core files.<\/p>\n
I am looking for help form the community and also to alert the community if this is truly a hack.<\/p>\n
Files added that are suspicious are:
\n\/wp-logon.php
\n\/wp-radmin.php
\n\/wp-content\/plugins\/tinymce-advanced\/mce\/code\/wp-comments-blog.php<\/p>\n
There were added in the order listed above, seconds apart from one another.<\/p>\n
I am running wordpress version 4.1.1
\nI am running Elegant Themes Divi Theme version 2.2 (I will also post on the Elegant Theme support site just in case)<\/p>\n
Plugins running are:
\nAdmin Menu Editor – Version 1.4.3
\nAll In One WP Security – Version v3.9.0
\nCMS Tree Page View – Version 1.2.31
\nContact Form 7 – Version 4.1.1
\nCustom Facebook Feed – Version 2.3.4
\nDuplicate Post – Version 2.6
\nEnable Media Replace – Version 3.0.3
\nEnvira Gallery Lite – Version 1.2.1
\nGlobal Content Blocks – Version 2.0.1
\nGoogle Analytics by Yoast – Version 5.3.3
\nGoogle Places Reviews – Version 1.1.3
\nGoogle XML Sitemaps – Version 4.0.8
\nImsanity – Version 2.3.5
\nJetpack by WordPress.com – Version 3.4.3
\nMedia File Sizes – Version 1.8
\nTinyMCE Advanced – Version 4.1.7
\nUnder Construction – Version 1.12
\nUser Role Editor – Version 4.18.3
\nWordPress SEO – Version 2.0.1
\nWP-Optimize – Version 1.8.9.10<\/p>\n
Of course I have no idea what plugin might have been vulnerable, of maybe the theme?? I am a very experienced developer, but the honest truth is that I don’t even know where to begin digging through these plugins to determine the breach. Or, maybe it was a breach through FTP or through my hosting provider (godaddy).<\/p>\n
For now, I have deleted the files, I desperately hope they do not return, but if the security hole is still there then they likely will.<\/p>\n
I will go and update wordpress, every plugin, and change FTP passwords.<\/p>\n
If anyone can suggest other items to look at, please let me know!!<\/p>\n","protected":false},"template":"","class_list":["post-6040019","topic","type-topic","status-closed","hentry","topic-tag-all-in-one-security"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/6040019","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/6040019\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=6040019"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}